Your data stays in Australia

• Hosted in Melbourne.Call recordings, transcripts, and customer details are stored in Australia — not sent offshore.
• Encrypted at rest. Your data is encrypted in storage and protected by access controls.
• Retention you control. Recordings and transcripts are retained for 90 days by default, and you can change that to suit your obligations.
• Yours to export. Export your calls, transcripts, and contacts at any time.

Honest AI, by default

• It says it’s an AI.Your agent introduces itself by name and identifies as an AI assistant when asked — never pretending to be a person.
• It follows your script. The agent answers from the knowledge you give it and stays within the workflow you set.
• It hands off when unsure. Rather than guess, it captures the question and warm-transfers or escalates to your team by call, SMS, or email.
• You keep the record.Every call is recorded and transcribed in your dashboard — searchable and exportable.

Call recording, done properly

Call recording in Australia is governed by state and territory surveillance and listening-devices laws, and the rules differ: some states require the consent of everyone on the call (for example NSW, the ACT, SA, and WA), while others permit recording with one party’s knowledge (for example Victoria, Queensland, Tasmania, and the NT).

• Disclosure on by default. Your agent can announce that the call may be recorded, so callers are informed before the conversation continues.
• One posture, nationwide.Playing that notice helps you stay on the right side of the strictest all-party-consent states — wherever your callers are.

SMS that respects your callers

Text messages are covered by the Spam Act 2003, which the ACMA enforces. InStack is built to keep you compliant:

• Consent and identification. Messages identify your business clearly.
• A real opt-out. Marketing messages carry a working unsubscribe, actioned promptly.
• Transactional vs marketing. Booking confirmations and reminders are handled distinctly from promotional messaging.

Outbound calls within the rules

When your agent makes scheduled callbacks or outbound calls, it works within the Do Not Call Register Act 2006 and the telemarketing industry standard:

• Register-aware. Outbound calling can be checked against the Do Not Call Register where it applies.
• Legal calling hours.Calls respect permitted days and times — not late nights, Sundays, or public holidays.
• Stops when asked. The agent identifies itself and ends the call on request.

Compliance by industry

Different industries carry different obligations. InStack’s onshore, consent-first approach is designed to fit them:

• Clinics & allied health. Health-service providers that hold health information are bound by the Privacy Act 1988and the Australian Privacy Principles — regardless of size. Melbourne hosting, encryption, and retention controls are built for exactly this.
• Accountants & tax agents. The Tax Practitioners Board Code requires client confidentiality and multi-year record retention. Your recordings and transcripts stay onshore, encrypted, and exportable.
• Everyone else.Salons, real estate, trades, and more — the call-recording, SMS, and outbound protections above apply across the board.

Security & certifications

• Encryption & access controls. Data is encrypted at rest, with access limited to your account.
• SOC 2 in progress. We are working toward SOC 2 to formalise our security controls.
• Responsible AI.Our approach aligns with the Australian Government’s Voluntary AI Safety Standard, with transparency and human oversight built in.

The law this maps to

For your own due diligence, the Australian frameworks relevant to an AI phone agent include the Privacy Act 1988 and the Australian Privacy Principles, the Spam Act 2003, the Do Not Call Register Act 2006 and telemarketing industry standard, the state and territory surveillance and listening-devices Acts, the Australian Consumer Law, and the Voluntary AI Safety Standard.

Questions?

Talk to us about your specific obligations at admin@instack.com.au. For how we handle personal information, see our Privacy Policy.

A note on this page

This page describes InStack’s product capabilities and approach in plain English. It is general information, not legal advice, and you remain responsible for your own compliance. Please consult your own adviser about how these laws apply to your business.